'''
__ __ ____ _ _ ____
| \/ |/ __ \ /\ | | | | _ \
| \ / | | | | / \ | | | | |_) |
| |\/| | | | |/ /\ \| | | | _ <
| | | | |__| / ____ \ |__| | |_) |
|_| |_|\____/_/ \_\____/|____/
http://www.exploit-db.com/moaub-18-cmsimple-xsrf-vulnerability/
'''
- Title : CMSimple XSRF Vulnerability
- Affected Version :CMSimple <=3.2
- Vendor Site : www.cmsimple.org
- Discovery : Abysssec
- Description :
===============
CMSimple is one of the smallest, smartest and most simple Content Management Systems under the GPL or AGPL licence.
This CMS supported Multi language.
- Vulnerability:
==================
XSRFs
--------
Several XSRF existed in this CMS, attacker can use them for: changing admin password ,change use type or ,Deface the website.
Here is vulnerable code:
file:cmsimple/adm.php[line 141-180]:
if ($action == 'save') {
if ($form == 'array') {
$text = " $v1) {
if (is_array($v1)) {
foreach($v1 as $k2 => $v2) {
if (!is_array($v2)) {
initvar($k1.'_'.$k2);
$GLOBALS[$a][$k1][$k2] = $GLOBALS[$k1.'_'.$k2];
$GLOBALS[$a][$k1][$k2] = stsl($GLOBALS[$a][$k1][$k2]);
if ($k1.$k2 == 'editorbuttons')$text .= '$'.$a.'[\''.$k1.'\'][\''.$k2.'\']=\''.$GLOBALS[$a][$k1][$k2].'\';';
else $text .= '$'.$a.'[\''.$k1.'\'][\''.$k2.'\']="'.preg_replace("/\"/s", "", $GLOBALS[$a][$k1][$k2]).'";'."\n";
}
}
}
}
$text .= '?>';
}
else $text = rmnl(stsl($text));
if ($fh = @fopen($pth['file'][$file], "w")) {
fwrite($fh, $text);
fclose($fh);
if ($file == 'config' || $file == 'language') {
if (!@include($pth['file'][$file]))e('cntopen', $file, $pth['file'][$file]);
if ($file == 'config') {
$pth['folder']['template'] = $pth['folder']['templates'].$cf['site']['template'].'/';
$pth['file']['template'] = $pth['folder']['template'].'template.htm';
$pth['file']['stylesheet'] = $pth['folder']['template'].'stylesheet.css';
$pth['folder']['menubuttons'] = $pth['folder']['template'].'menu/';
$pth['folder']['templateimages'] = $pth['folder']['template'].'images/';
if (!(preg_match('/\/[A-z]{2}\/[^\/]*/', sv('PHP_SELF')))) {
$sl = $cf['language']['default'];
$pth['file']['language'] = $pth['folder']['language'].$sl.'.php';
if (!@include($pth['file']['language']))die('Language file '.$pth['file']['language'].' missing');
}
}
}
}
else e('cntwriteto', $file, $pth['file'][$file]);
}
+POC:
show this code as html page to CMS Admin:
Change Password and Deface site.